Scribd Logo
Încărcați

Bine ați venit la Scribd!

  • WEbinar CSI

    Încărcat de

    Marcos Vinicius Cassel
    22 vizualizări32 pagini
    Cyber Forensics: Insights on Moving Forward Jim jaeger, director, cyber defense and forensics. "We need real-time Situational Awareness in our networks," says jaeger. The new price of doing business is going beyond compliance, he says.

    Descriere originală:

    Drepturi de autor

    © Attribution Non-Commercial (BY-NC)

    Formate disponibile

    PDF, TXT sau citiți online pe Scribd

    Vi se pare util acest document?

    Este necorespunzător acest conținut?

    Raportați acest document
    Cyber Forensics: Insights on Moving Forward Jim jaeger, director, cyber defense and forensics. "We need real-time Situational Awareness in our networks," says jaeger. The new price of doing business is going beyond compliance, he says.

    Drepturi de autor:

    Attribution Non-Commercial (BY-NC)
    Descărcați ca PDF, TXT sau citiți online pe Scribd
    Indicator pentru conținut neadecvat
    22 vizualizări32 pagini

    WEbinar CSI

    Încărcat de

    Marcos Vinicius Cassel
    Cyber Forensics: Insights on Moving Forward Jim jaeger, director, cyber defense and forensics. "We need real-time Situational Awareness in our networks," says jaeger. The new price of doing business is going beyond compliance, he says.

    Drepturi de autor:

    Attribution Non-Commercial (BY-NC)
    Descărcați ca PDF, TXT sau citiți online pe Scribd
    Indicator pentru conținut neadecvat
    din 32

    Presented by

    Robert Richardson
    CSI Director
    Thanks!

    The 2010/2011 Survey Report is


    Available at GoCSI.com, either on its
    Own or as part of a CSI membership.
    Cyber Forensics:
    Insights on Moving Forward

    Jim Jaeger
    Director, Cyber Defense & Forensics

    December 2010
    Cyber Security

    Capabilities Key Solutions and Programs

    • Commercial forensics & incident response • Department of Defense Cyber Crime Center (DC3)
    • Cyber operations & monitoring • United States Computer Emergency Readiness Team (US-
    CERT)
    • Digital forensics
    • Department of Homeland Security National Infrastructure
    • Indications & warning systems
    Coordinating Center, National Operations Center
    • Network security
    • National Security Agency signals intelligence and
    • Information operations
    exploitation
    • Department of Justice/Federal Bureau of Investigation,
    Drug Enforcement Agency
    Reaching Beyond Compliance
    • Every large enterprise must now
    deal with constant cyber attacks

    • 100% of the enterprises we’ve


    investigated were compliant with
    some security standard

    • In their cases, compliance


    provided a false sense of security

    • Every set of compliance standards is understood by hackers

    • To protect your enterprise the new price of doing business is going


    beyond compliance
    Situational Awareness
    “Often times, our situational awareness is,
    indeed, forensics--which means that
    something has happened and policing
    up after the fact--versus mitigating it in
    real time.
    We need real-time situational
    awareness in our networks, to see
    where something bad is happening and
    to take action there at that time. We do
    not have ‘common-operational picture’
    for our networks. We need to get there.
    We need to build that.” General Keith Alexander, Congressional
    Testimony, 9/23/2010
    Cyber Situational Awareness
    Know What Normal Is Know the Threat Share Information
    • Knowing your network • How they move • CSI Computer Crime and
    • Recognize changes • What they are after Security Report
    • Where they are going • Industry discussions
    • US-CERT
    Key Strategies: Handling of Logs
    • Logging Enabled
    – Significant – 25%
    – Basic factory settings –
    75%
    • Log Storage
    – Long term – 5%
    – Moderate – 40%
    – Minimal – 55%
    • Log review/analysis
    – Limited – 50%
    – None – 50%
    Evolving Situational Awareness Tool Set
    Industry is recognizing the need

    Capabilities are being developed in demos and test beds to create


    a “common operational picture”
    Evolving Investigative Arena
    From one examiner/one case/one box,
    to forensics teams using distributed tools
    to work large data sets and cross case analysis

    Requires technology
    – SANs to store and
    access the data
    – Strong network and
    data security to
    prevent
    contamination
    – Sophisticated data
    mining and
    visualization tools
    The Building Blocks: Partners
    • Computer Emergency
    Response Team
    • Cyber Forensic
    Organization
    • Law Enforcement
    • Legal Community

    The team brings strength beyond


    that of an individual organization
    Jim Jaeger
    Director, Cyber Defense & Forensics
    General Dynamics Advanced Information Systems
    240.294.2221
    jim.jaeger@gd-ais.com

    S-ar putea să vă placă și